Today is my first day at Oxide Computer Company - <AUTHOR> https://steveklabnik.com/writing/today-is-my-first-day-at-oxide-computer-company <comment><USER2> As a mere mortal, I am more interested in their podcast than their products. :) Hopefully, they will produce more episodes in the future: [https://oxide.computer/podcast/](https://oxide.computer/podcast/)

</comment><comment><USER3> Can someone provide on ELI5 for what this company does and how it's different? I get that its goal is to allow folks to buy instead of rent their hardware, but how is it different from the old days of buying servers? Are they trying to offer folks AWS or Azure quality servers for purchase? Or am I just totally missing this?

<comment><AUTHOR> So, I was trying to keep this post short and to the point, but if you want a longer description, straight from the mouth of one of the founders, you may like [https://www.youtube.com/watch?v=vvZA9n3e5pc](https://www.youtube.com/watch?v=vvZA9n3e5pc)

> Are they trying to offer folks AWS or Azure quality servers for purchase?

I think "quality" doesn't really capture 100% of it, but in a sense, yes. The goal is extremely quality, performant, robust servers.

I will have to delegate the details to the above talk; I have a bunch of work to get started on, and would just end up re-typing out what it says above, ha!

<comment><USER4> It seems that video has been posted to HN twice, but didn't attract any comments either time, sadly.

I don't have the energy to watch a 90 minute talk, but some skipping around finds a bit more detail about what is in the plan:

[https://youtu.be/vvZA9n3e5pc?t=1299](https://youtu.be/vvZA9n3e5pc?t=1299)

The theme seems to be giving the operator of the computer a lot more control - eliminating opaque binary blobs, exposing the hardware more directly, etc. I can't tell if this is a particular bee in the founders' bonnets, or a real market demand, or if they know about some scary threat they can't talk about.

Whilst this is definitely cool, and something that will get a lot of people on HN super pumped, it doesn't sound like something any company i have worked at would really care about. Unless these machines also deliver significantly better performance. But then, those companies were not hyperscalers.

<comment><AUTHOR> My personal take on this bit is that it's not something that customers care about directly, but impedes overall quality, which they _do_ care about. We'll just see how it all goes, of course!

</comment></comment></comment></comment><comment><USER5> I'm really curious as to what Oxide's plans are who are they selling servers to – individuals or companies? Is the plan to build your own data center or is it to throw a few of their servers in a collocated spot? Who is the competition, cloud providers, VMWare, something else?

Anyways, good luck at your new job it sounds really exciting!

</comment><comment><USER6> Even though I am an employee of a so-called "hyper-scale" cloud vendor, I really am rooting for Oxide. There are actually a lot of hard problems in this space, and Oxide are inherently more agile than a big cloud vendor. As long as they focus on problems that aren't enormous monetary black holes (which I'm assuming would end Oxide), they are making the world a better place. Also very much appreciate the podcast.

</comment><comment><USER7> @steveklabnik: Just out of curiosity, did it not work out at Cloudflare? Seems like a rather short stint.

<comment><AUTHOR> Still on very good terms with Cloudflare. It was just over a year. I am just extremely excited about what Oxide is up to, and wanted to get in on the ground floor. I wasn't actually planning on leaving Cloudflare, just sometimes, opportunities come up and you have to take them. Or at least, in this instance, I decided I wanted to take it.

</comment></comment><comment><USER8> Wow, congrats!

</comment><comment><USER9> 404

<comment><USER10> resolves for me by now

<comment><AUTHOR> I recently re-did my website, and it is a bit fragile in places. Should be all good now!

(I can't wait until Notion releases an official API...)

<comment><USER11> Yeah, the waiting is killing me.

</comment></comment></comment></comment><comment><USER12> I'm not interested in the incessant self promotion of a single individual.

What software products have you written from scratch?

Or are you mostly talking and keeping your name in the press.

<comment><USER13> Why is "from scratch" the determinant of a good engineer? That's a tiny portion of the work, and only a single component of an individual's contribution.

<comment><USER14> Obviously if you are not writing your programs in binary by manually magnetizing a hard drive, you are not a _real_ engineer.

I personally only use CPUs that I have hand made from the organic metals mined in my backyard.

<comment><USER11> I cant stop laughing!!! I may die soon! Awesome reply!</comment></comment></comment></comment>


Ask HN: Per User or by Project - <AUTHOR> Hi, I am about to release a software service for building wireframes (I know one of too many :-))
I see few of them charge per user and few charge by Active Projects
I am not able to decide what should be the pricing model? As a developer or web designer what provides the most value? <comment><USER2> > As a developer or web designer what provides the most value?

The question is: who is likely to pay?

Individuals really don't like to pay.

Companies don't mind paying.

Therefore charge per user because multi-user is almost certainly a company.

Most SaaS companies that have a product that can be used by both individuals and companies try to charge for features that are important for companies.

For example on GitHub you can have as many free public repos as you want because public repo strongly implies an individual.

If you want even a single private repo, you pay, because private strongly implies a company.

<comment><AUTHOR> Thanks. I like the per user approach. It will keep the logistics also simple and straightforward.</comment></comment>


Ask HN: What are some good books for Personal Development? - <AUTHOR> What are some books that you guys find really helpful? <comment><USER2> The Seven Habits of Highly Effective People by Stephen Covey. In my opinion, the ONLY book on self development you ever need read.</comment>


We Are Now One Year Away From Global Riots, Complex Systems Theorists Say - <AUTHOR> http://motherboard.vice.com/2012/9/10/we-are-now-one-year-and-counting-from-global-riots-complex-systems-theorists-say--2 <comment><USER2> First off, Occupy professes non-violence and does not riot.

If you are reading these words, and you are a parent of young children, I want you to conduct a thought experiment: Imagine you have no food in your home, zero. Add to that you have enough money for one meal a day to be shared with your kids. Your children are hungry and you can not feed them. Add to that everyone on your block or neighborhood being as hungry as you are. Got this picture? Now answer this question: Is there anything you would not do to feed your hungry kids, stop them from crying?

edit: World food prices in total rose 25 percent in 2010.

[http://www.guardian.co.uk/global- development/2011/jan/23/foo...](http://www.guardian.co.uk/global- development/2011/jan/23/food-speculation-banks-hunger-poverty)

[http://www.bloomberg.com/news/2011-01-24/speculation- swings-...](http://www.bloomberg.com/news/2011-01-24/speculation-swings-may- threaten-food-security-ministers-say.html)

I don't have kids, but I did a fast of only juice for a week so I know a bit what it is to feel hungry. It makes you to strange things.

edit: why the down votes?

<comment><USER3> _First off, Occupy professes non-violence and does not riot._

Isn't this like saying "Anonymous professes _____ and does not ______?" Anyone can call themselves "Occupiers."

Food is pretty much a solved problem, at least in the US. It used to take virtually the entire country's labor to feed itself. Now agriculture is a single-digit percentage of the workforce.

Of course we can debate whether what's on the supermarket shelves should really be called "food," but for most Americans the question has been settled to their satisfaction. There aren't going to be any food riots in the US.

<comment><USER4> Food is a solved problem as long as there are water and oil.

<comment><USER2> [http://www.paleycenter.org/collection/item/?q=charles+kuralt...](http://www.paleycenter.org/collection/item/?q=charles+kuralt&p=9&item=T77:0042)

that is from 1968

</comment></comment></comment></comment><comment><USER5> People have been predicting catastrophe for thousands of years. Without some reason to believe these people (and "a graph that shows correlation between some points that might well be cherrypicked" doesn't count), I see no reason to give this article any credence.

<comment><USER6> Indeed, the data that correlates riots with food prices needs to be backed up with more than that study.

In addition, I found this statement concluding the article to be completely lacking support: "And it's only going to get worse and worse and worse."

Why should we expect food prices / rioting to get worse and worse?

<comment><USER7> Because global climate is going to get worse and worse.

<comment><USER6> Source that this will cause high food prices?

From our standpoint, technology and automation will get better and better, bringing the price of many things down.

Humans have demonstrated their ability to adapt to change.

<comment><USER8> >Humans have demonstrated their ability to adapt to change.

And that realization only comes after some big wars, famines and disasters.

There are only a few instances where we have changed proactively.

Humans have always needed a wake up call.

</comment></comment></comment></comment></comment><comment><USER9> 1 year away? It looks like we _are_ in a period of global riots: Tunisia, Libya, Egypt, Syria, Bahrain, Yemen. The sectarian violence in Iraq. Anarchy in Somalia, South Sudan. I don't think we've ever seen so many independent conflict areas.

<comment><USER10> No we're not. Countries that have (or had) long standing dictatorships are rioting. The closest the first world has had to a riot is when Canada lost that hockey game.

<comment><USER11> What about the Occupy Protests in LA?

<comment><USER2> I would not even call the Black Bloc rioters. They use guerrilla tactics, hit and run.

Occupy protests are not riots despite all the police in riot suits standing around sweating.

<comment><USER2> Feds on hackernews, rad!

</comment></comment></comment></comment></comment><comment><USER8> In my country(India), for a while people have been predicting country wide mass riots for fresh water(portable water). And it doesn't look surprising at all, looking at where we are currently.

Cities are already faced with huge crisis for water. The under ground water tables are depleting like crazy. There are villages which practically have no water at all, they have to go around nearby villages to scout for water. There are some states like Tamil Nadu, where water crisis is so imminent, if Karnataka and Kerala were to stop releasing water they would be in serious trouble. But this is not limited just to one state. The rivers are heavily polluted, and beyond any meaningful usage. In the name of development and growth, lakes and ponds and cities have been converted to spaces for buildings and urban infrastructure. In early days nearly every village used to have a lake, that culture vanished with appearance of tube wells. People are paying a high price for that culture. This is likely to affect nearly every aspect of India life.

With irrigation methods belonging to old stone age and population on an upward trend. This is a classic recipe for disaster.

You may have your mobile phones, PC's, iPods and jeans pants. But without food and water none of it is going to every workout well.

<comment><USER2> There were violent water riots in Peru last year when the government tried to privatize the water supply. Prices whent up more than 100% I think.

Thank you for sharing this Kamaal.

<comment><USER12> This is not true, the riots in Peru were over giving mining rights to foreign interests: <http://www.bbc.co.uk/news/world-latin-america-13913776>.

Peru's water problems are real, and not easily summed up i the term "privitization:" <http://www.economist.com/node/5526571>

<comment><USER2> I apologize for my mistake. I am thinking of another country in South America that had public waterworks privatized briefly.

Thank you for the links.

</comment></comment></comment></comment><comment><USER13> This is a false assumption as it ignores several mechanisms behind the riots themselves.

A better conclusion would be "rising food prices make riots easier to incite". The reason for the false assumption is the notion that the Arab Spring was largely leaderless or organic; it was not.

Most of the Arab Spring protests were encouraged and incited by the Muslim Brotherhood. The crippled economies were an excellent motivator for people to take to the streets - they did, after all, not have any work to do.

However, food prices were only a small piece of the puzzle that made the countries ripe for unrest. Many other components helped it along, including our country's naive actions.

<comment><USER2> I think you are confusing "riot inciters" with community leaders.

<comment><USER14> I would point out that one man's 'riot inciter' is another man's 'community leader'.

</comment></comment></comment><comment><USER15> This article would have a lot more weight if it was served from mit.edu or even cdc.gov.

<comment><USER16> That depends how much you trust your corporate or government funded researchers :)

</comment></comment><comment><USER17> Not sure this will pan out. It sounds like scientists are close to being able to release new UG99 resistant wheat crops, which means there should be more grain in the middle east by this time next year.

</comment><comment><USER18> Change happens in spurts, only after things get bad enough to overcome apathy (i.e. I agree that a good way to look at this is complex systems theory). The last spurt was the 60's. The narcissism and growing wealth gap of the 90's and 00's are starting to make things bad enough again. I wouldn't be surprised if it happens this decade.

</comment><comment><USER19> I wonder how much bad the drought would have been had we done something like cut back on livestock farming. If all of the water that goes towards growing livestock feed + keeping the animals watered instead went directly to plants grown for human consumption, would it have still been as bad?

<comment><USER20> Livestock farming is crucial to keeping grain prices stable. Human demand for calories is relatively constant, for obvious reasons, but only accounts for a small majority of grain demand in normal years. The remainder is consumed by animals and by industrial processes.

When grain gets expensive, feeding animals becomes expensive. Raising them becomes unprofitable, so farmers dump their animals onto the market which 1) lowers the price of meat 2) makes a large number of meat calories available for human consumption when they are needed most and 3) reduces the demand for grain, dampening the price rise for grain.

This effect has mostly replaced the need for the long-term grain storage that countries used to do.

So why isn't working now? One word: ethanol. President Obama could single- handedly stop the current food crisis by eliminating or suspending ethanol subsidies and mandates.

<comment><USER19>
      > The remainder is consumed by animals and by
      > industrial processes.

Grain raised for livestock use is _only_ for livestock use. It's not like "corn" is all the same thing. The corn that is used for livestock is not the same corn that you buy at the store (on the cob or in a can). It's tasteless, and so far as I know, not desirable for human consumption. You can't treat all of the corn produced as usable for all uses that corn is put towards.

Also, if livestock is what regulates the grain market, then why do grain- producers get such large (non-ethanol-related) subsidies?

<comment><USER20> "The corn that is used for livestock is not the same corn that you buy at the store (on the cob or in a can). It's tasteless, and so far as I know, not desirable for human consumption"

No, but it is suitable for turning into meal, which is how corn is consumed in the third world, or into HFCS which is how corn is consumed in the first world.

For other grains, it mostly works in the other direction in normal years. For example, a farmer may try to grow wheat suitable for bread, but it rains while the crop is in windrow, making it unsuitable for bread due to its low protein content. It's graded as "feed" and fed to animals in a normal year. However, you can still make bread from it, it just doesn't rise as well.

"why do grain-producers get such large (non-ethanol-related) subsidies?" Because farmer's causes are sympathetic to voters for various different reasons. (historical attachment, enjoyment of low food prices, stereotyping of farmers as close to the land, lower populations in rural districts, and many others)

</comment></comment></comment></comment><comment><USER21> I would like to see the correlating data regarding the increase of ethanol in gasoline with the rise in food prices/riots as well. I seem to recall that just before the Haitian riots in 2008 there was an increase in ethanol mixture of gasoline.</comment>


Ask YC:  Why does the web 2.0 community act as if software were not infinitely malleable? - <AUTHOR>

It's really bizarre.  Bloggers in particular write about startups as if they were physical objects that are hard to change.  They make a big deal out of the launch date and whether the service has left beta as if these notions had much meaning.  They make predictions about whether a service is doomed without thinking too much about how it might evolve.<p>I suppose one can argue that bloggers simply reflect the views of users.  Since users don't think of a service as infinitely malleable (or perhaps don't want it to be since change requires learning), then bloggers just do the same so that their posts make sense to users. <comment><USER2> OTOH, many users have been burned by things that _could_ easily be fixed... but never were.</comment>


Twitter Exploit Still Works - <AUTHOR> http://www.davidnaylor.co.uk/twitter-exploit-still-works.html Twitter XSS exploit from yesterday still works. They haven't done a very good job of fixing it. You only need to see an exploited tweet to be affected! <comment><USER2> Seriously, their response was to disable spaces in the form?

There is no legitimate reason for anything other than \w to be in there... how about a real filter? Twitter has been lazy and generally pathetic in just about every area since they began... talk about getting lucky with a good idea.

<comment><USER3> There is no legitimate reason to not _escape the damn output_ , either. Twitter has officially reached the level of satire, folks.

63 Employees. 55 Million dollars. And twice they fail to accomplish the trivial.

<comment><USER4> And don't they use Rails, which presumably makes it very easy, if not the default, to escape HTML output?

<comment><USER5> PSA. Escaping html only helps if you're allowing user-generated text outside of any tag.

If you're allowing user-generated text into a html tag (ie. this case.) Escaping html tags won't help.

<comment><USER4> Why not?

The substitution they do is , and you can "game that" by inserting '[http://foo.com>](http://foo.com>); other stuff goes here <whatever foo="">' Fine. The literal HTML that the user sees becomes 'other](http://foo.com>other) stuff goes here <whatever foo="">'. That's bad.

Now if you escape that properly, you get: '' Garbage, but not a security problem.

(BTW, news.arc fucks up the escaping too, so this example is garbage. Sorry. See nopaste here: <http://scsys.co.uk:8001/33063>

Edit: _sigh_ , that is also broken! Bottom line; none of these things will happen to you if you replace every & with &, every " with ", every ' with ', every < with < and every > with >.)

<comment><USER5> Congratulations, you've just stopped one particular attack.

There'll be something you forget. Blacklisting is only a good idea if whitelisting isn't possible. (see the \w above)

eg. You forgot. javascript:alert(document.cookie) Which depends on click and in and of itself isn't dangerous but a symptom of a greater problem.

edit: except you need to allow more than \w.

</comment></comment></comment></comment></comment></comment><comment><USER6> I generally take the view that people are too hard on Twitter, and that maintaining a gigantic network like this is a lot more difficult than it looks.

This, though, as a 'fix,' is just complete incompetence.

<comment><USER3> I used to give them the benefit of the doubt on that. I've now changed my view to: it's probably more difficult than it looks, but Twitter makes it look _impossible_.

</comment></comment><comment><USER7> To anyone with any level of web security experience, the real fix for this (proper escaping) should be obvious.

For every really trivial vulnerability like this that Twitter can't fix, there must be scores of slightly more subtle vulns that go undisclosed.

</comment><comment><USER8> Semi-off-topic, but I found something seriously wrong with Craigslist.

<https://post.craigslist.org/manage/1340717167/tkrju#tr231033>

That link will allow you to edit that post. You don't even have to be logged in.

I've already alerted them, but let's see how long this lasts.

<comment><USER9> The hashtag isn't necessary, ie <https://post.craigslist.org/manage/1340717167/tkrju> works too.

Actually, I think craigslist probably views this more as a feature than an exploit. Since you don't need an account to post on craigslist, they can't do normal cookie based authentication, so they just give you a secret url for editing your page. Unfortunately, the only thing secret about the url is a 5 character alpha-numeric string, which I suppose would be possible to brute force.

</comment></comment><comment><USER10> Wow... Did some brand new intern get assigned the responsibility to "fix" this?

Like the author said, I think I'll be off Twitter for a little while too.

</comment><comment><USER11> This is unbelievable. Even more so that they would not just disable the displaying of the application until they are sure that thing is fixed. My guess is this was just the beginning of big time spam/phish/... problems for twitter...

</comment><comment><USER12> If you still want to use the (scary) web interface, there is always NoScript.

<comment><USER13> Twitter should disable everything except registration through the web interface. If it is not a script injection vulnerability, it is a 404 error returned for the CSS file resulting in a linear layout, or the web interface not loading at all. The API on the other hand is usually up (and by extension so are third party apps.) If they focus their attention on supporting the API they could charge app developers a fee, which many would happily pay since they would be the exclusive interfaces used for Twitter (since the web interface would be gone) and they could build ads, charge for app use, and provide customized extended Twitter functionality.

I am completely half serious on this.

</comment></comment><comment><USER14> does this mean that if I am using tweetdeck on a mac that i am vulnerable?

<comment><USER15> No, the exploit is only for applications capable of interpreting JavaScript, such as web browsers.

<comment><USER16> Except that there are a lot of RIA twitter clients that render the tweets in a Webkit view.</comment></comment></comment>


Apple Said to Team with Visa, MasterCard on iPhone Wallet - <AUTHOR> http://www.bloomberg.com/news/2014-08-31/apple-said-to-team-with-visa-mastercard-on-iphone-wallet.html

<comment><USER2> They're missing their greatest opportunity ever to be the sole an only payment method of the wearable age.

Pair an iWatch with an iPhone/iPad point of sale via iBeacon and you have the simplest payment method of all.

<comment><USER3> They probably thought about it and then figured it was easier to deploy globally and satisfy regulatory hurdles by working with MC/Visa. Besides, I am almost certain that whatever "solution" will be priced as an extra premium card and that retailers will have greater processing costs that'll conveniently be sent Apple's way.

After all supporting iOS payments says quality, right?

</comment></comment><comment><USER4> Ibeacon /NFC + fingerprint = 2factor .. Would imagine that is even safer than chip + pin.</comment>


Harvard scientists are modifying yeast to mass produce LSD - <AUTHOR> http://m.guardian.co.uk/science/blog/2011/jun/21/scientists-make-lsd-from-microbes?cat=science&type=article

<comment><USER2> [http://www.guardian.co.uk/science/blog/2011/jun/21/scientist...](http://www.guardian.co.uk/science/blog/2011/jun/21/scientists- make-lsd-from-microbes?cat=science&type=article) non-mobile link</comment>


Hackers acting in Turkey's interests believed to be behind recent cyberattacks - <AUTHOR> https://www.reuters.com/article/us-cyber-attack-hijack-exclusive-idUSKBN1ZQ10X <comment><USER2> So I'm not an expert by any means, but from what I understand, estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial evidence, including IP addresses, malware signature, and possibly timestamps/localizations within the binaries.

All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and _trivially_ modify the evidence to implicate any state actor/group who's modus operandi are known in hacking circles, no?

Which, incidentally, is why I had issue with the certainty with which croudstrike, for example, pointed to Russia over the DNC hack. Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail...and these are hackers we're talking about, after all.

<comment><USER3> Since you admit that you're not an expert, you shouldn't really assume that attribution is that simple, or that they aren't fully aware of these things you mention.

<comment><USER4> Because all of these things being trivially manipulated means in the past, attribution was entirely done for nation states to point at other nation states or for scam artists to promote their cyber cyber cyber security technology consulting services. If there is such a thing as "the science of attribution", and that is very questionable, it sure as hell isn't above the noise floor.

<comment><USER3> No, that is not the case.

</comment></comment></comment></comment><comment><USER5> We need DoH (DNS over HTTPS) and/or DoT (DNS over TLS) faster and everywhere, including routers, browsers, OSes. And we need to get rid or find a viable alternative to this hostile hotel and airport WiFi hijacking DNS login methods which is essentially the same this hackers have done in a larger scale! We need some alternative and good method for that.

<comment><USER6> Agreed. The wireless (and wired) login/ToS page redirects common in guest Wifi and corporate environments were never really designed for. They work now by abusing what are essentially design flaws, and they don't even work very well.

Another glaring hole in Wifi is that there's no open + encrypted option. Your options are basically open with no encryption at all, personal mode (shared key for authentication and encryption), or enterprise mode (username + password, certificate-based, or similar).

The Wifi authentication standards should really be modernized to address these issues.

</comment></comment><comment><USER7> >As part of these attacks, hackers successfully breached some organizations that control top-level domains, which are the suffixes that appear at the end of web addresses immediately after the dot symbol, said James Shank, a researcher at U.S. cybersecurity firm Team Cymru ...

Anyone know which TLD orgs were hacked?

</comment><comment><USER8> On a possibly-related subject, these three things seem like a big coincidence when taken together:

(1) Yesterday I noticed Wikipedia was way slower than normal. Article pages took ~30 seconds to load sometimes. (Down Detector agrees this: [https://downdetector.com/status/wikipedia/](https://downdetector.com/status/wikipedia/))

(2) Yesterday, Hacker News had a headline Wikipedia was accessible in Turkey for the first time in years. (See [https://news.ycombinator.com/item?id=22153304](https://news.ycombinator.com/item?id=22153304)) Some people in that thread also noticed the coincidence between this and #1.

(3) Now this story about cyberattacks from (or on behalf of) Turkey.

<comment><USER9> These attacked occurred in 2018 and 2019.

<comment><USER8> That's not how I read it. First of all, the headline says "recent". The article mentions some attacks in 2018 and 2019, but it also says the "broader series of attacks is ongoing".

<comment><USER9> Ok.

I don't understand what the original post is implying then.

These aren't denial of service attacks, so what is the connection between Wikipedia being slow and some attacks that started in 2018 and are continuing now?

</comment></comment></comment></comment><comment><USER9> There's more details on the _SeaTurtle_ attack this was related to[1][2][3][4].

It looks like the new information here is that intelligence officers are confident enough to link the group to Turkey. Previously FireEye thought it was an Iranian group.

[1] [https://www.zdnet.com/article/hackers-breached-greeces- top-l...](https://www.zdnet.com/article/hackers-breached-greeces-top-level- domain-registrar/)

[2] [https://techcrunch.com/2019/04/17/sea-turtle-talos-dns- hijac...](https://techcrunch.com/2019/04/17/sea-turtle-talos-dns-hijack/)

[3] [https://blog.talosintelligence.com/2018/11/dnspionage- campai...](https://blog.talosintelligence.com/2018/11/dnspionage-campaign- targets-middle-east.html)

[4] [https://www.fireeye.com/blog/threat- research/2019/01/global-...](https://www.fireeye.com/blog/threat- research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at- scale.html)

</comment><comment><AUTHOR> journalist's thread [https://threadreaderapp.com/thread/1221837856622153733.html](https://threadreaderapp.com/thread/1221837856622153733.html)

<comment><USER10> It's a shoddy story. Quote: "Our sources told us the hackers had gained access giving them the ability to intercept ALL INTERNET TRAFFIC going to several countries in the Middle East" Way back, I used to work with dissidents/journo's/academics against censorship and surveillance at various countries. All but Turkey where easy because I recall that it was the military being in full control; playing with BGP among other things. This makes the quote a bit awkward. Why would they gain abilities already possessed & put their cards open on the table ?

<comment><USER11> _If_ they had access to the undersea cable(s), that would certainly be different than having the ability to fiddle with (generally detectable and attributable) BGP attacks.

My money is on this being similar to the leaks of tapes where a bunch of high ranking Turkish military & members of the administration were discussing false-flag attacks from Syria to have a reason to invade, basically the US feeling they have exhausted their diplomatic channels to Ankara and dropping pieces of intel into the wild to get Turkey to stop what they are doing.

<comment><USER10> # The "attack" level of sophistication does not befit a state actor. # The Reuters article mentions 2 British and one US security _officials_ # Same Reuters article states that GCHQ and US equivalent declined inquiry. ( Mind bullet #1. ) # Turkey states there has been no data ex-filtration; sources do not mention serious damage on either side.

The most simple explanation is usually true, so I think a security firm like NCC group ( GCHQ still holds a stake in them ) is creating waves for business.

<comment><USER11> Re "state actor", while reading the headline I figured "oh, they would have called it 'state actor' if it was believed to be Russian or Chinese", but reading the article, they may have chosen not to use that term also because it wasn't MIT but some loosely affiliated patriotic group. Given that the borders between state and non-state are very fluent in Turkey, there may also be multiple things being attributed.

Still very much possible that it's FUD/PR, there's likely information, misinformation, PR and news hyping in any such report, with degrees of each varying.

</comment></comment></comment></comment></comment><comment><USER12> The evidence, if true, shows the hackers are acting in Turkey, but I don't see the proof that it is in Turkey's interest.

Disclaimer: I'm a Turkish citizen. I don't support what our government have been doing since 2006 except for some small stuff about healthcare and such. I could never vote for the winning party since I was given the right to vote.

<comment><USER13> Reading the article, it seems the conclusion was inferred from the fact that Cyprus, Greece, Albania and Turkish Masons were targets. That those targets are not a good way to steal but are all disliked by the current regime. That several western analysts concluded they were government sponsored and that the attacks were quite complex.

<comment><USER14> What are the chances the hackers disliked one of those targets and only attacked all of them to throw the investigators off?

<comment><USER15> That is a commonly used technique actually and one to throw off the scent of false attribution. Although no evidence is cited in the article and all the nebulous case is built on anonymous sources.

The last disastrous piece on the alleged hack of firmware at AWS and Apple by the Chinese was built on anonymous sources as well and the cyberhacking article was not retracted or apologized by Bloomberg.

[https://www.bloomberg.com/news/features/2018-10-04/the- big-h...](https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how- china-used-a-tiny-chip-to-infiltrate-america-s-top-companies)

Time will not be forgiving to the authors of this article.

Maybe Reuters has article quotas on cyberattacks per month and it's close to the end of the month and they need to fill it somehow. It's the journalistic equivalent of being pulled over by cops for no reason towards the end of the month so they can issue a ticket and fulfill their quota.

And my favorite part is Turkish interests. Is that a couple of script kiddies who speak Turkish sitting in a basement in their pjs taking a break from Fortnite or PUBG?

This article makes Judith Miller look like a real journalist like Walter Cronkite. Judith Miller of NY Times wrote stories based on multiple western anonymous and credible sources covering WMD in Iraq.

[https://en.m.wikipedia.org/wiki/Judith_Miller](https://en.m.wikipedia.org/wiki/Judith_Miller)

</comment></comment></comment></comment><comment><USER16> 'The hackers have attacked at least 30 organizations, including government ministries, embassies and security services as well as companies and other groups, according to a Reuters review of public internet records'

Which public internet records?

<comment><USER17> I'm guessing they did a whois on the domains linked to the attack.

</comment></comment><comment><USER18> Define "Turkey's Interest".

<comment><USER19> The Turkish government is seeking to tap into eastern Med's natural gas and oil reserves, while ignoring International laws and discarding neighboring countries Exclusive economic zones.

So acting basically like a pirate and threating each day with war. Let me give you a few examples and you can verify them later any way you wish.

In Cyprus the sent -not one but two- drilling ships and research vessels to search for oil, with the escort of Turkish Navy of course. They failed to find gas in one location and are moving to the next. To add insult to the injury they even say they will share what the find, like a thief saying he will sell your stuff and share with you the money...

In Greece were I live, there is a lot of up-heat with the recently signed Turkish-Lybian moratorium which basically ignores the Greek island of Crete (as well others smaller ones) and declares EEZ with Lybia, which they call "neighbours" (look at a map please), at the same time ignoring the rights of Greece, Cyprus, and Israel.

Also search for the clean water crisis in Iraq, which Turkish government is ...also to be blamed. Basically they build dams cutting Euphrates river flow and DENYING their neighbor's RIGHT for clean water, violating other International agreements.

<comment><USER19> Also let me remind you of the war in Lybia which the GNA is loosing, so they signed a deal with Turkey in order to help them win the war

</comment></comment></comment><comment><USER20> Turkey has 80 million people and a GDP of $770 BILLION (nominal) or $2.3 Trillion PPP. Essentially unlimited money and manpower--for the task at hand.

<comment><USER21> that would make sense if 100% of turks were ultranationalists hellbent on spying countries of 10, 3 and 1 million.

<comment><USER20> They don't need 80 million hackers. They need the state to fund hackers from a huge pool of 80 million people. Or just set hackers loose for patriotic reasons.

<comment><USER22> A third of this population is underaged for hacking and another third will not be educated above primary school. It seems like a much smaller pool of "hackers" when you consider that this is a land where a large percentage of adults are undereucated farmers and workers are living off of agriculture, textile and menial labour. Where the general consensus is to spend a large sum of your money on government sponsored games of chance, or if you are on the more religious side, go and spend it on magic items and blessings. At any given time you will probably get 30-50 highly skilled hackers (self-taught out of pure chance) and rotation will be high due to getting a large number of opportunities to live a better life abroad.

</comment></comment></comment></comment><comment><USER15> What is the difference between this article and fake news? A whole article built on anonymous sources. Who are these credible anonymous sources? Donald Duck?

And doing a DDOS attack is quite trivial and any script kiddie could launch one from their computer or if they are slightly more adept from other peoples computers.

Turkey in fact is one of the most backward countries in terms of cybersecurity (and cyberattacks).

Turkey was just attacked recently with DDOS attacks and whole countries Internet came to a standstill. Did the anonymous sources have any thoughts on that?

Just look at Shodan to see how vulnerable and backward Turkey is in cybersecurity matters:

[https://www.shodan.io/](https://www.shodan.io/)

<comment><USER23> Anonymous sources are an essential part of journalism, and Reuters is reputable enough to use them responsibly.

> The weakest sources are those whose names we cannot publish. Reuters uses > anonymous sources when we believe they are providing accurate, reliable and > newsworthy information that we could not obtain any other way. We should not > use anonymous sources when sources we can name are readily available for the > same information.

> Unnamed sources must have direct knowledge of the information they are > giving us, or must represent an authority with direct knowledge. Remember > that reliability declines the further away the source is from the event, and > tougher questions must asked by reporters and supervisors on the validity of > such information.

[http://handbook.reuters.com/?title=The_Essentials_of_Reuters...](http://handbook.reuters.com/?title=The_Essentials_of_Reuters_sourcing)

<comment><USER24> Unfortunately Reuters is famous for fabricating fake need in the name for some state actors too.

<comment><USER23> It's hard to take these accusations at face value without evidence.</comment></comment></comment></comment>


Chemistry Creates Self-Stirring Liquids - <AUTHOR> http://www.wired.com/wiredscience/2010/01/self-stirring-liquids/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29&utm_content=Google+Reader

<comment><USER2> Did anybody else think of this when they saw the pictures?

<http://www.youtube.com/watch?v=3zoTKXXNQIU></comment>


Distributed big balls of mud (2014) - <AUTHOR> http://www.codingthearchitecture.com/2014/07/06/distributed_big_balls_of_mud.html <comment><USER2> Sometimes I feel like microservices is pushed by hosting providers to get more money from all the additional deployments...

<comment><USER3> I'm not a computer programmer or scientist, but I work with a group of them. The argument I've heard them say - and I may well be misrepresenting it here - is that microservices are often used as a way to avoid getting better at parallel processing/programming. They're working on a huge amount of data processing using Go if that provides any context. I'd be curious what others think of this idea.

<comment><USER4> I think it's likely that the recent faddishness of Go, which upon actual use turns out to be difficult to use for anything /except/ microservices, itself is causing microservice adoption.

<comment><USER5> If I can rephrase this without it being a criticism: Go encourages particular patterns of use, much like any technology.

Rails, for example, strongly encourages programmers to keep a company's entire operations in a single application and memory space. Many Rails shops eventually discover that this is suboptimal for their needs, for example when one _particular_ part of all of their operations need to be scaled up substantially but scaling a "monorail" requires memory proportionate to the _total size_ of all operations times the highest desired throughput of _any_ piece of the system. I'm aware of several Rails shops which needed to retroactively decompose a monorail, and many of them rewrote the performance- intensive part in Go, as Go is bugs-in-your-teeth fast for many common workloads.

Just like Rails "wants" to be a monorail, Go feels to me like it wants to be a collection of small, X00 to ~2k line programs, talking to each other via JSON messages passed either over HTTP or a queueing system. (Use NSQ! It's fantastic!)

Partly this is due to affordances in Go's design for e.g. deploying systems. If you want to re-deploy, just compile (for free) and copy the binary everywhere. Partly it is due to Golang not yet having much in the way of community norms for building really big systems. Dependency management is a very unsolved problem and gets worse the larger the individual pieces of your system get. Golang also isn't very opinionated about project structure in the way Rails is, which counsels keeping parts of your system bite-sized as a way of imposing structure on top of it. (By comparison, you can drop any intermediate Rails programmer into virtually any Rails program and say "Find the login page. Find the $FOO business logic." and they'll be able to do it in a few seconds.)

</comment></comment></comment></comment><comment><USER6> > but the design thinking and decomposition strategy required to create a good > microservices architecture are the same as those needed to create a well > structured monolith

I don't think that this quite captures the utility of something like microservices.

For example, if you split your frontend and backend into separate projects, then the barrier for entanglement becomes so much higher. Instead of just importing some frontend class for the backend, you're loading in stuff from a totally different project and making 2 coordinated patches for them. Doesn't that feel wrong somehow?

The appeal of microservices (much like functional programming) comes from imposing restrictions that make dangerous things harder. Reducing the possibility of breaking your own rules on clean programming.

(Disclaimer: I don't think microservices are worth it for smaller projects though)

<comment><USER7> > The appeal of microservices (much like functional programming) comes from > imposing restrictions that make dangerous things harder.

But, don't microservices make safe things harder too? What's the point in simultaneously making both safe and dangerous things harder?

</comment></comment><comment><USER8> a) If the time and complexity to deploy 3,10,100 microservices as opposed to 1 monolith is significant then your build pipeline is flawed. Simple as that.

b) Maybe the commenter has only worked on small applications but I've worked on enough million line code monstrosities to know that one change can have far reaching consequences. It is simply too easy to couple components together e.g. be reusing a shared utility or service class and your code coverage will always be lacking in some way.

c) Microservices enable far more resiliency and scalability simply because you can deploy more of the ones that are critical or non performant. A sensible service discovery strategy can make this a one button, trivial exercise. Doing so on a complex monolith is often far from trivial.

d) This idea that your entire system goes down if a microservice goes down indicates your architecture is flawed. You should be able to still operate in a degraded state or at least provide some functionality.

e) If you can't test your service independently then your testing strategy is flawed. You should be able to trivially mock/stub out any dependencies and if you can't then you need to rethink your API design and the nature of your coupling.

<comment><USER9> The reality of things is, though, that at many (most?!) companies the pipeline IS indeed flawed BUT must work.

In other words for various reasons it's been built flawed. Speed, idiocy, politics, whatever. At some point, you have various choices to pay your technical debt:

\- actually pay it(50%+- work force full time on this, forever - hey, it works long term, but only short term gains means bonus pay check, and making things square isn't as fun as building new stuff)

\- patch shit up so it kinda works and hope to leave before it's too horrible (what most do)

\- dissolve the company/product (eventually happens, almost inevitable over long enough periods of time - specially when people got tired of the shit and rebuilt everything anew - then the cycle starts again)

This blog post uses the 2nd solution (the most common).

</comment></comment><comment><USER10> To me, microservices address for many the continuing need for structures that hide complexity behind small, understandable interfaces. Black boxes if you will. Unlike components, which have no standard for connecting to and among each other, microservices do - in a relatively standard and easy to understand way. That's why they are so attractive.

I find myself very much agreeing with the author, but being involved in modeling complex business problems into object-oriented code, I'm more frustrated that in a problem domain, we have no effective modular concept for groups of collaborating objects. We can't walk up to an object graph and immediately understand the functionality it performs and the services it provides.

<comment><USER11> >To me, microservices address for many the continuing need for structures that hide complexity behind small, understandable interfaces.

You can have loosely coupled software with or without micro-services and you can have tightly coupled (ball of mud) software with or without micro- services.

All microservices do is multiply the problems caused by creating that ball of mud.

If you want to hide complexity behind small, understandable interfaces that's laudable goal, but it is not one that distributing your application across a network is going to help you with.

<comment><USER12> I think your first point is obvious, but I disagree with your second, at least 'at-scale'.

In the case where you have loose coupling but are representing multiple entities that scale in different ways, microservices allow you to separate concerns and separately scale those concerns relative to their requirements in terms of memory/CPU/disk/network/etc. The best factored code running in a single horizontally-scaled layer will be inefficient if 90% of requests are manipulating entity A, and entities B, C, and D have a lot of intricate business logic but are rarely touched (they are better off if separated and scaled individually)

The overhead you allude to is definitely something to take into account. If you're a 5-20 person startup without a serious need to scale up or lacking people who have built the tools that make microservices easy, you should avoid the issue for now. But ultimately, decoupling services so they can horizontally scale independently is a huge win.

<comment><USER11> True, but if you prematurely divide your services up based upon what you think their performance requirements might be _you will be wrong_. That's premature optimization, which is, as we all know, the root of all evil.

If you've loosely coupled your services until the point where it becomes obvious that two parts of the code have markedly different performance requirements and _then_ you decide to split them into two separate services then yes, that could work, provided you understand the trade off you're making.

I don't think that's typically what people mean by 'microservices' however.

There's a good chance it'll still be wasted effort, too. Hardware is cheap. Developers are not. That applies to large businesses and small.

<comment><USER13> I always saw the point of micro services as not having to figure out the scaling part yet.

If you focus on grouping by purpose rather than what resource they might use then you can keep them on small instances until you better understand what kind of resource they require.

Once you learn their usage pattern you can adapt more quickly (if scale is needed at all) and not have to first split up the code.

</comment></comment></comment></comment></comment><comment><USER14> The "headline" of this submission is actually the final phrase of a comment on a year-old blog post, way down at the bottom.

<comment><USER15> Ok, we changed the title from '"We're leaving the idea of independently deployable services and not looking back"' and added a 2014. It's not entirely off limits to link to an interesting comment rather than the root article, but in this case perhaps it doesn't add enough over the article itself.

There's certainly nothing wrong with an article being a year old if it's good.</comment></comment>


Execute BASIC Programs in Minecraft - <AUTHOR> http://www.gamnesia.com/news/a-fan-has-developed-a-way-to-write-and-execute-basic-programs-in-minecraft <comment><USER2> Anything to get kids interested in programming is a good thing, right? My son already tells people he can "program in JSON" because of Minecraft's little command-block DSL that's comprised of instructions structured as JSON. It's really adorable and has piqued his interest in broader programming, and "stunts" like Minecraft BASIC interpreters can only help.

<comment><USER3> My 11 year old son has been programming in Scratch for a few years, and kind of hit a dead end. So we recently bought him Sams Teach Yourself Mod Development for Minecraft in 24 Hours. It goes straight into some pretty heavy Java, but with a lot of hand-holding. He's really loving it so far, and seems to be learning a lot and making good progress.

<comment><USER4> Have you tried Code Combat? [1] Or, Vim Adventures? [2] Of course, you might skip the vim because real programmers use emacs.

[1] [https://codecombat.com](https://codecombat.com)

[2] [http://vim-adventures.com/](http://vim-adventures.com/)

<comment><USER3> We all know real programmers use butterflies. I've been letting my son focus on the code rather than the editor, so he's using Eclipse per the aforementioned book's recommendation.

</comment></comment></comment></comment><comment><USER5> Next time some gray-beard like me starts bragging about having learned to program on an 0.001 Ghz Apple ][ with 0.000016 GB of ram, you can tell them you learned on an 0.00000002 Ghz Redstone processor.

</comment><comment><USER6> Turtles have been a thing in modded minecraft for quite a while, with two mods that add the functionality, Computercraft and OpenComputers.

ComputerCraft being the earlier mod is quite easy to get started with. Some iron and redstone makes you a basic computer capable of scripting via Lua, another layer of iron and some more redstone turns it into a turtle which you can equip with tools to automate certain tasks. Swords to kill monsters, pickaxes to dig through stone, axes to chop down trees.

OpenComputers adds some more very fun features. Computers are built from parts (CPU, RAM, HDD, GraphicsCard, Disk Drive), and you have to flash a BIOS before getting started, as well as adding a screen and keyboard. After getting a computer up and running, you're faced with a unix like command line environment a bit more advanced than computercraft. There's also a lot more cool blocks to play around with, from the 3D printer to hologram projectors, again all controllable using Lua scripting.

There's a ton of potentially educational mods that aren't programming based as well, like Rotarycraft and Reactorcraft, the former being based on realistic machinery (from Fermenters to multi-step mineral extraction), the latter on a simple nuclear reactor model (going from isotope centrifuges to toroidal fusion reactors).

If you do want to play around with it, try downloading one of the launchers like FTBLauncher or ATLauncher, and just loading up a modpack. If you're intrested in Rotary/Reactorcraft or OpenComputers, I can recommend the Revolution modpack on the ATLauncher, though I haven't played it these last 3 months.

<comment><USER7> ComputerCraft also has an "education" version, which includes a visual programmer for turtles similar to scratch (which also allows you to switch to the generated lua code as well)

[http://computercraftedu.com/](http://computercraftedu.com/)

<comment><USER6> That's really cool. Haven't played since late September, so I might not be on top of all the changes going on with modded Minecraft. I heard of the Teachergaming thing on another thread on here in a thread on MinecraftEdu.

Really neat.

</comment></comment></comment><comment><USER8> Why has this not been commented on yet? My comment: cool!</comment>


Tweet Sentiment analysis prediction, incremental training, visualization - <AUTHOR> https://github.com/uiuc-ischool-scanr/SAIL

<comment><AUTHOR> This is a first GUI based tool for sentiment prediction of tweets using a model trained on research level tweet sentiment data. The tool allows a user to incrementally update the model with more information. It also supports a sentiment based timeline visualization of tweets.

All kind of feedback in welcome. Do contribute to the repository if you like.</comment>


Bay Area Startup seeking 3rd Co-Founder (traction, revenue, funded) - <AUTHOR>

Teamly.com is our startup - it's a SaaS tool to help teams be more effective at work. It is built with ruby on rails, less, jquery, chef, MySql, AWS, Rspec, etc.
Where we are - I recently left my very well-paying salary job to work on Teamly with my co-founder. We are now both working on Teamly full time. We have an up and running product, good traction (very active users), paying customers (freemium model), and a ton of user feedback. We are closing an angel round of funding (our first) and have some other related (non-public) big news as well. We are now focusing on our user feedback to really improve the product.
Who we are - Matt Berman (me, hacker/technical marketer) and Scott Allison (hustler) are the two current co-founders. My career background is in growth hacking and coding but I have experience with business as well. I've worked at large corporations and startups alike. Scott has had 3 previous successful businesses and is the most dedicated hustler I've ever met. He is technical in terms of knowledge but doesn't code.
Who we are looking for - We are looking for our 3rd and final co-founder to round out our skill set. We are definitely looking for another hacker to join us. This is not a small equity type position, we are looking for a true co-founder/partner. Expertise with Rails is a must and front end skills are a plus. The three main qualities we are looking for in a co-founder are: expertise/knowledge of our stack, passion/dedication to startups and our space, and resourcefulness (aka scrappiness). We are looking for someone who is in the Bay Area as well.
We believe we are on to something special and are currently at an exciting point for our startup. This is a chance to help mold not only an awesome product but a business as well. If you are interested in learning more, we'd love to hear from you!
Matt & Scott - Teamly.com - email@example.com <comment><USER2> I'm the other cofounder of Teamly. Matt is very kind to describe me so nicely, but I feel just as lucky to have found him. As well as being extremely inquisitive he gets stuff done, and is as passionate about Teamly as I am. We clicked straight off, and that's why we're putting in so much effort in finding the right additional cofounder to join us now. It's far more than about technical skills, it's about fit and passion.

</comment><comment><USER3> I'm not directly interested in the job position, but it's good to see you guys growing.</comment>


Scrum in 7 minutes - <AUTHOR> https://www.youtube.com/watch?v=jNhRX-RBs_4 <comment><USER2> Nice overview of the process! Had an "Oatmeal-esque" feel to the animations.

On a more serious note, who's tired of big organizations pretending to be Agile while demanding all the process/overhead/documentation of waterfall? We have 3 week sprints and my manager recently asked for a "bug triage" plan stretching out 4 months... I had no words.</comment>


Will Industry Agree to a Meaningful Do Not Track? - <AUTHOR> https://www.eff.org/deeplinks/2012/04/will-industry-agree-meaningful-do-not-track <comment><USER2> Do Not Target would then be equivalent to security cameras, so I see that is the ultimate outcome.

You cannot viably eliminate tracking via Do Not Track... the entire modern Internet is based on the concept of tracking.

</comment><comment><USER3> The "do not track" concept relies on 3rd party decency and you don't have to look much further than the spam in your Inbox to see how well _that_ works. A do-not-track request is like saying "please don't take my lunch money"; that request would be honored by almost everyone but do you think it would change what a bully does? If you put something valuable in your front yard with a sign that says "property of Joe Smith", sure it might stay there a few hours...but eventually someone will come along and take your property anyway.

In the real world you might be able to find witnesses and involve the police to deal with a theft. On the Internet there's nobody to report a "do not track" violation to and no reliable way to punish anyone who simply ignores what you say. The 3rd party doing the tracking can be _anyone in the world_.

</comment><comment><USER4> I can't see how the online business can afford to allow Do Not Track. Put the other way: you can only have gmail if you agree hand over your personal information to Google.

<comment><USER5> _Put the other way: you can only have gmail if you agree hand over your personal information to Google._

That would be soo awesome!

Also, from where comes this belief that tracking generates such an absurd amount of money? It _must_ be some sort of "it will be valuable in the future" thinking going on because today it can't mean much.

 _IF_ tracking was so effective it would be something that the customer wanted (and there you have it - that's how the online business will survive, by actually producing something that the customer wants). Now it's just sad and the only real feature of tracking and content aware ads is that when there have been an ax murder you will get a discount on axes - which is so bad it is kind of funny.

<comment><USER6> This thing about discount on axes would likely still happen without tracking. Tracking in itself will allow to do things like do frequency capping (do not want to display the same ad 400 times to the same person), give higher values to displaying ads many times (second time is worth more!), or to display ads to someone we know has visited one of the ads' customer websites.

The general idea is to be able to do this kind of regrouping, and it is, for all purposes, anonymous past what a browser can usually send (IP addresses allowing to derive geographical location) unless you try to use tracking to generate some very precise information on a user. This is generally useless to do because real information will come from third parties and you don't need to do all that work by yourself.

That is to say, I'm much more worried about a company like google doing tracking when they know my mobile phone number, age, gender, name, occupation, etc. Than any third-party tracking business that will pretty much never know these things for sure, except when a business like Google or Facebook will tell them about it.

In general though, all of this tracking is much less worse than whatever use of a credit card I make, given they openly do much more invasive searches and can do far more with this information than most online businesses, limited to displaying ads that might or might not fit my likings better.

</comment></comment></comment><comment><USER7> After reading all 3 parts of the series the thing that bugs me most right now is:

Heck, those are great ideas! I'd like to write a tracking system that does everything possible to collect the data and uniquely identify the users! It doesn't sound that hard.

I wonder how many of those tracking companies find the "Privacy Awareness" articles actually to be very nice "How to better track your users" articles.

</comment><comment><USER8> Sorry for the shortness of the reply:

No.

Simply because it's contrary to capitalist ideals.

<comment><USER9> As long as the ads & analytics industries continue to see the options as "meaningful Do Not Track" or "indiscriminately grab all the data you can", then I agree.

However, as the article suggests:

 _If [the industry refuses a meaningful Do Not Track], Internet users who do not want their online reading habits recorded by invisible tracking companies will have only one choice: use ad blocking tools to stop online tracking code themselves. In order for this to work, they will have to block a huge portion of the advertising on the Web, too._

If indiscriminate tracking keeps becoming increasingly obnoxious and/or insidious, it will eventually overcome the users' apathy, and they'll fight indiscriminate tracking with indiscriminate blocking. Users have the power to kill the internet tracking industries, they just don't have the will (yet). A meaningful Do Not Track option would show that the industries were willing to compromise with the users, which would go a long way to defuse the growing will to do away with them.

Refusing to compromise with the people who have the power to destroy you is never a good plan in the long term. Ask Louis XVI, or the Tsars.

<comment><USER10> If enough people use ad blocking technologies, the ads and analytics industries will simply switch to server-side / invisible-to-the-end-user options.

The only reason why tracking and ad serving isn't done like this today is because it's a pain in the ass and there's high switching costs. Make current practices unprofitable, and switching suddenly looks appealing.

A lot of previously theoretical workarounds are being quietly turned into commercial products these days. As a consequence of all the privacy fuss, there's a good chance you'll end up with less privacy than before.

<comment><USER9> Eh, it's an arms-race, if the tracking systems move on-server, then adblock et al will adapt to still block them, or be replaced by something that does.

I could see either the trackers or the anonymisers coming out on top. Or we could end up with single-user:single-identity type walled gardens and darknets running side-by-side.

</comment></comment></comment></comment><comment><USER11> They probably won't agree, though I have no basis for that claim other than witnessing capitalism-in-motion for so many years.

However, does it really matter? With things like ad-block, ghostery, noscript, etc; in the end the consumer more or less has the final say. Awareness of these type of plugins will only become more ubiquitous over time as the world becomes more and more tech savvy; and/or this tracking has a negative effect on consumers that they actually feel.

If someone cares enough to look for a do-not-track setting, likely they can be bothered to find a plugin that enforces it.

In the end though I agree with `methodin`; the line for tracking is really fuzzy without breaking basic functionality. The nature of the internet is such that users are going to have to take their anonymity, in-so-much as they desire it, into their own hands; and tools that make it easy for them will continue to be, and I presume grow, ever more successful.</comment>


As Data Collecting Grows, Privacy Erodes - <AUTHOR> http://www.nytimes.com/2009/02/16/technology/16link.html <comment><USER2> "The way Mr. Rodriguez's positive steroid test result became public followed a path increasingly common in the computer age: third-party data collection. We are typically told that personal information is anonymously tracked for one reason -- usually something abstract like making search results more accurate, recommending book titles or speeding traffic through the toll booths on the thruways. But it is then quickly converted into something traceable to an individual, and potentially life-changing."

That's troubling even for someone who is not an A-list celebrity like A-Rod.

<comment><USER3> If it troubles you, it's still very easy to avoid being surveilled by most of these systems. Pay cash instead of using a credit card. Don't use EZ-Pass. Turn off your phone when you're not using it. Yes, it is inconvenient, but trading privacy for convenience means you don't value it very much. People got along fine before EZ-Pass came along.

Until we have mandatory legislated tracking devices in cars, etc. (not a far- fetched idea at all, and something that must be fought), you are largely the keeper of your own privacy.

<comment><USER4> In Illinois, you pay twice as much for tolls without EZ-Pass; a literal cost of privacy.

And it's getting significantly harder to avoid these kinds of surveillance. You forgot to mention: never have a utility bill, or a mortgage, or a car...

"Do it yourself" is no longer an effective option.

</comment></comment></comment><comment><USER5> Most of us recognize the value of having such detailed data, and also the consequences of it (like in this article). I would prefer not to have to "trust" the company storing the data, and I think leaks like this make it clear this can't be the approach in the future. So how can this problem be solved from a technology perspective?

I'm aware of k-anonymization, where you change the data to make it mathematically impossible to identify an individual data point more specifically than among k entries. So for example

      Age Weight Disease
      18 150 Cancer
      45 203 Diabetes
      37 197 Heart Disease

becomes

      Age Weight Disease
      * * Cancer
      [36-45] [195-210] Diabetes
      [36-45] [195-210] Heart Disease

for k=2, and it's now impossible to know for sure the disease of the 45-year- old, whereas you could deduce that information from the earlier records.

Another approach, used by some major search engines for ad-targeting, is to insert random noise into the data.

What other solutions are there? If you build software that captures sensitive data, how do you deal with it?

<comment><USER6> One set of data is not the issue.

It's when you start compiling knowledge (I almost want to say "evidence") from multiple data sets that privacy is really invaded. Couple your anonymous dataset with the search histories of the people involved, and you'll likely get your answer.

Or couple it to their travel info to see which hospital are they likely to have visited so regularly - does the hospital have a specialist diabetes or heart disease unit?

</comment></comment><comment><USER5> I remember a research talk where the speaker said that, empirically, there are 3 reasons consumers give up their privacy: convenience, (the perception of) security, and money.</comment>


Ruby Deoptimization Engine - <AUTHOR> https://github.com/ruby/ruby/pull/1419 <comment><USER2> If I understand the implementation correctly, this seems like it has a low ratio of complexity to performance improvements. It will be interesting to see if this ends up landing in MRI. I'm anxious to see some non-micro benchmarks against "real world" Ruby, which basically means the Rails test suite, start up time, etc.

My only concern would be what kind of impact this has on memory usage. Having all of those in memory copies of method implementations hanging around probably comes at a cost. But in general the world seems to be OK with trading memory for speed these days. If Ruby is twice as fast for less than twice the memory then we can easily consider it a win.

Anecdotally, it seems like servers these days have plenty of RAM to spare relative to CPUs anyway. A semi-recent Rails app that ran on AWS EC2 m4.xlarge's with 24 Puma workers only used 5.5GB of the available 16GB of RAM.

It also looks like the spirit of this optimization comes from the work Chris Seaton and others have been doing with Ruby and the Graal VM. It's great to see work like that having an impact on MRI.

<comment><USER3> Check out [https://rubybench.org/benchmarks](https://rubybench.org/benchmarks) for Rails, Ruby, and Bundler benchmarks on every commit and release to either project.

If you want Rails-specific benchmarks for Ruby commits I suggest the `discourse_` benchmarks that are running specific chunks of the open-source Discourse Rails app: [https://rubybench.org/ruby/ruby/commits?result_type=discours...](https://rubybench.org/ruby/ruby/commits?result_type=discourse_home)

<comment><USER4> Thanks for the link, this is an excellent resource.

I really appreciate this view for the rails commits: [https://rubybench.org/rails/rails/commits/overview](https://rubybench.org/rails/rails/commits/overview)

</comment></comment></comment><comment><USER5> I've posted this link a number times on HN, but for more wonderfully written background on this, read Chris Seaton's blog here: [http://chrisseaton.com/rubytruffle/deoptimizing/](http://chrisseaton.com/rubytruffle/deoptimizing/)

</comment><comment><USER6> Wait, so what is this doing? I'm very confused.

<comment><USER7> [http://chrisseaton.com/rubytruffle/deoptimizing/](http://chrisseaton.com/rubytruffle/deoptimizing/) mentioned above gives an excellent explanation. I was completely confused by the name.

"In Ruby..." [we could have]... " deoptimization. It allows us to reverse the just-in-time compilation process and go back to a simpler interpreter where all the checks Ruby needs are explicit, all the objects really exist, and we have code paths to handle anything."

It seems like Ruby has a whole lot of features that actually make optimising it very difficult (monkey patching et al), and this is their attempt to work around it.

<comment><USER6> ...You know, they could just limit monkey-patching, and drop call/cc and a few other features (not having call/cc opens a lot of options), and they'd have a dramatically easier system to work with, right?

When was the last time somebody used call/cc in ruby code, anyways? By current implementation, it's only useful for thought experiments and toys, and we have Scheme for that.

In short, deoptimization seems like a case of solving one of the sinister black tendrils of the problem, not the root cause.

<comment><USER8> The problem with limiting monkey-patching is that it's used extensively and with great variety in Rails (and other popular Ruby projects).

Monkey patching, done correctly, will "settle" over time. That is, once your rails app has called all the dynamic finder methods it's ever going to use, and `require`d all of the `active_support` extensions it'll need, it's done monkey patching. Of course, there are programming mistakes that can open a huge bag of worms, such as using `OpenStruct`s. Generally, anything that will smash the global method cache[1] is also going to require the kind of `iseq` deoptimization that this pull is about (in fact, smashing the global method cache is a simple case of deoptimization).

This is why deoptimization is so useful - it's almost never going to happen after your app has settled, but it's necessary to maintain correctness while `active_support` is being loaded and adding all of those yummy methods to core classes.

`call_cc` can go to hell though - I've never seen a program that uses it ;-)

[1] [https://github.com/charliesome/charlie.bz/blob/master/posts/...](https://github.com/charliesome/charlie.bz/blob/master/posts/things- that-clear-rubys-method-cache.md)

<comment><USER6> Yeah, but there's got to be a less needlessly overcomplicated way of doing this. It's ridiculous.

As for call_cc (or to use its "real" name call/cc, or call-with-current- continuation), my usual response to those that propose dropping call/cc (usually proposing shift/reset or similar as a replacement) is "over my dead body," but that's Scheme: supporting weird experiments is part of Scheme's job, and there's at least one high-quality implementation of Scheme that uses Cheney-on-the-MTA compilation, which makes call/cc fast enough for Real Work. In ruby, the situation is different: call/cc is slow, expensive, and Ruby is a language for getting stuff done, not academic experiments about control structure.</comment></comment></comment></comment></comment>


Reop – reasonable expectation of privacy - <AUTHOR> https://github.com/tedu/reop

<comment><AUTHOR> Some more info: [http://www.tedunangst.com/flak/post/reop](http://www.tedunangst.com/flak/post/reop)

</comment><comment><USER2> thanks for sharing</comment>


Ask HN: What is your favorite advertising platform? - <AUTHOR>

<comment><USER2> I'll eat my own dog food and toot my own horn and say the saas version of mysimpleads we're working on, of course. Looking to release beta invites in June with it being like openx/buysellads together only simpler.

</comment><comment><USER3> If you want to buy direct display advertising, buyads.com is the way to go (full disclosure- I work there).

</comment><comment><USER4> <http://buysellads.com>

</comment><comment><USER5> posting on hackernews

</comment><comment><USER6> Adwords</comment>


Ask HN: Is shareware dead? - <AUTHOR> Are there any HN users who make $$ from a shareware ? Any full timers doing this ? <comment><USER8> Shareware is not dead, but I would say the term 'shareware' is.

These days it's just software. You have free software that gives you a limited user experience or timed trial to decide if you want to buy the full thing.

Look at any app store and look at the free rankings. It's practically full of nothing but "lite" versions that only exist to give you some features to help you decide whether you want to pay for the full version.

If anything 'shareware' is more alive than ever although it goes by different names these days, 'lite', 'freemium', etc.

<comment><USER9> The idea behind the word "shareware" is that you "shared" the demo version with your friends, and anyone who wants to buy a licence can.

So now that we get everything from a direct download, it makes sense that the term "shareware" is no longer used. The concept of having the demo spreading organically as people share it is gone.

<comment><USER10> Right, thinking about it, it could still work with very popular things like TV series. You release the whole season with bit-torrent to save bandwidth and marketing costs. Then after watching the first two episodes you have to pay for the rest. Sure there's no tech for that today, but hey startup idea!

<comment><USER11> Isn't this kind of what they're doing on Google Play, or what was done with Mr. Robot, minus the torrent? The first episode or two are free, then you either pay per episode or watch via TV subscription. I frequently download free pilot episodes to see if there are any shows I might be interested in watching. I would say that Mr. Robot was a great example of this. I heard about the show by word of mouth (it might have been here, or possibly on Reddit). I do not watch any other shows on USA, so it is likely that I would have never heard of the show had I not had the pilot recommended to me and easily available to watch on YouTube. I think that last part is key. I probably would not have made the effort to download a "USA" app, or jump through hoops to watch it on a web browser. Having it easily available on my phone where I could watch it with the built in YouTube app was perfect.

<comment><USER10> My idea is that you share the whole season with "friends" on torrent and other file-sharing sites. Not only the free episodes. You download the entire season! This takes care of both distribution and most of the marketing. You of-course release it with the highest quality! And you do not need any infrastructure whatsoever to do this.

As in the spirit of shareware, you let people watch some of the episodes for free, then charge for the rest. And that's the part some smart people has to figure out.

An idea is to have the content encoded differently depending on the Internet routes. And some type of block-chain that would give you a key to decode the data, depending on a voucher code you insert to the chain.

</comment></comment></comment></comment></comment><comment><USER12> The word is pretty decisively dead [+]. Lots of companies make money by selling software over the Internet on a free trial model. As was routinely observed in the shareware community as we tired of the name, "How can we differentiate 'shareware' from the rest of the industry when _Microsoft Freaking Office_ is sold on a free trial model these days?" After the widespread rise of the web "You can give the installer executable to other people. Please do!" was no longer a really compelling advantage, and it _always_ confused a lot of civilians. ("You mean I don't have to pay for it, right?" "No, that is _not_ what shareware means." "You greedy bastard!")

I just sold my business which did this back in April -- it supported me above my previous day job salary for a while back in the day, before the rest of my business eclipsed it. I was, ahem, very much not the most successful HNer with the model, but many of the others like to keep things under their hat.

At least one received a check written on purple paper with an exclamation point on it, as if the dollar amount wasn't an exclamation enough. (He's occasionally active on HN and can tell you the story if he wants to, but it isn't mine to tell.)

[+] I used to be a card-carrying member of the Association of Shareware Professionals, which is now the Association of Software Professionals, because the membership expressed its opinion that the shareware branding communicated "crappy software which will give your Googles a virus but is otherwise free."

</comment><comment><USER13> The shareware concept is doing well, just the name has changed to "30-day trial" or "Lite" or "Free/Pro" or....

As an example, Andy Brice blogs about his shareware business at [http://successfulsoftware.net/](http://successfulsoftware.net/)

</comment><comment><USER14> Shareware as a business model is alive and well. It's likely that _most_ commercial software a user uses these days started as a demo they were testing, maybe with a few features missing, or nag screens or a timer -- then they upgraded it to a full licensed copy. For whatever reason, we stopped calling it shareware, but that's basically the model in use for closed-source commercial consumer-level software.

In many ways, shareware has become the "default" method for distributing commercial software, and it's non-shareware software that's kind of weird. This even happens on the high end. I worked for a desktop software company years ago, and we gave away our software on a 30-day trial, if they liked it, a seat cost $30k. It was called the "30-till-30" model by our sales guys who didn't realize it was just shareware.

Looking at my own list of software I have installed right now:

Chrome - free with open source version

Firefox - open source + donationware

Thunderbird - open source + donationware

MS-Office - <USER6>

Foobar - open source + donationware

yed - free, but with commercial tools as part of the ecosystem, this makes it in my mind pseudo-shareware

Gimp - open source + donationware

Simcity 4 - fully commercial

Notepad++ - open source + donationware

Sublime Text 2 - <USER6>

FileZilla - open source + donationware

Mirc - <USER6>

Anki - similar model to yed, desktop version is free, mobile is paid

Bulk Rename Utility - donationware, closed source

Caustic - similar model to yed, desktop version if free, mobile is paid

Pycharm - <USER6>

renoise - <USER6>

bunch of steamgames - most started as a demo, so I'll go with shareware

skipping over python, perl and the usual open source suspects

and on my phone: most started as a "lite" version so many of the apps are all<USER6>
</comment><comment><USER15> We make an downloadable product [1] that over its lifetime has been sold as donationware, freemium and trial-based -- three of the main variants that shareware evolved into.

Short answer: downloadable trial software is still viable... we're doubling revenue each year and supporting a team of 6.

 _Donationware_ (product is free for life, occasionally nagged for money). Lesson's learned: 1) It's no way to live, but a good way to start, as the userbase was at it's most vocal with feedback back then, when we were trying to hit product/market fit (perhaps because 'donation ware' felt much more community-spirited). 2) I don't have exact conversion numbers, but I do remember being surprised by how much an individual donated ($1 was the minimum, $30 the average, $300 the max). I've read studies since that if someone is asked to name their own price, they'll be much more generous (the downside being not as many people will pay anything at all).

We then tried _freemium_ (features were restricted until people paid). Lesson's learnt: 1) Do freemium by resource constraints, not feature constraints (i.e. all features are available, but when you use X amount of data you have to pay). Because otherwise users just see a 'broken' product, and don't see the point in paying for something less-useful. 2) We also noticed that most people quit in the first two weeks, and almost everyone who didn't, paid. I.e. the 'free plan' was hardly used (related to the first point). Thus it was just a maintenance burden.

Now we have a two week _trial_ , and then you pay. Lesson's learnt: 1) Benchmarked against freemium, conversion increased 4% in real terms (and 20% in relative terms). Mostly because it nudged the small % of 'free plan' folks from above into buying.

[1] www.activeinboxhq.com

</comment><comment><USER16> Lot's of people make money from shareware, if you mean "software with a free trial or evaluation period". In the age of halfway decent worldwide network connectivity and third-party download sites that bundle adware/spyware, the idea of letting other people distribute one's software for you is probably dead.

If it didn't have all the historical baggage from the BBS days, I think that "shareware" would be the perfect replacement for FSF's somewhat awkward "libre software" or the more ambiguous "free software". Heck, most people already treat free trials as something they can download, install, run forever, give to their buddies, distribute over the corporate LAN, etc.---WinZIP being the canonical example. The word "share" really gets to the heart of what FSF's "software freedom" is about, which is modification and re-distribution by end users.

</comment><comment><USER17> Could "freemium software" be considered to be the new "shareware software"? With both types, you get some features without paying, and you must pay for the full experience.

</comment><comment> T-hawk Shareware conflated two different concepts that are now separated: the distribution model, and the pricing model.

The distribution model was the genius of shareware at the time. In the days before the Internet and websites, physical distribution of the bits was a significant challenge. Shareware got the users doing the distribution work for the creator. Take this free version and copy and share it as much as you like. This succeeded very well, of course. But it's just outmoded now when anyone can toss up a website to host anything.

The pricing model is alive and well, we now call it freemium. Offering a limited free version, with a paid upgrade for full features, has been successful all along and transitioned fine from the days of shareware to Internet-hosted distribution. Or the product was full-featured all along and just asked you to register on the honor system. That still exists too and we now call it donationware.

So the "share" part of shareware has been superseded, but there are still elements of it in the modern software industry.

<comment><USER18> >The distribution model was the genius of shareware at the time. In the days before the Internet and websites, physical distribution of the bits was a significant challenge. Shareware got the users doing the distribution work for the creator. Take this free version and copy and share it as much as you like.

That concept seemed to make better sense if you had people who were just handing disks around to friends. At that point the _share_ part was clearer.

What was always really annoying though was back in the late 80s/early 90s there were companies that basically existed just to duplicate floppies with shareware on them and sell them in stores.

I remember going to a computer store and seeing a couple racks of floppies with games or home software for $10 or so. If you weren't familiar with the shareware concept you'd assume you got a great deal -- only to take it home and discover you paid money for a disk with a single piece of shareware on it, not a full license to the software.

At least later on when companies started selling CD-ROM compilations with 600MB worth of shareware, it was more clear you were buying something to save you the trouble of downloading all that from a BBS, not buying a single piece of software.

</comment></comment><comment><USER19> I agree that the term shareware is dead, but time limited or feature limited freeware with a paid full version is not dead.

I make a living from [http://www.watermark-image.com](http://www.watermark- image.com) and other sw for windows, I have et a lot of people at MicroConf who makes a living from sw.

</comment><comment><USER20> Nobody today can offer a proprietary, binary-only program as a "trial demo", and call it "sharing" with a straight face.

Not when you can get an entire operating system loaded with packages that are all freely redistributable, open source.

It's still done, just not called "shareware".

Ah yes, now I remember; there used to be an etiquette behind using the term "shareware". Some people believed that the term "shareware" should only be applied to non-expiring, freely redistributable programs. Only thing is, those programs came only in binary form. Some forbade reverse engineering (like unlocking some increased functionality). It's still really not sharing; it's just dumping a free product on the market. Without bending that that etiquette too much, you could call Internet Explorer shareware.

</comment><comment><USER21> Insofar as the term "shareware" can be construed as users actively giving away copies, with references to where paid expansion/sequel software can be obtained, that's pretty much over with as the Internet has made distribution trivial (just provide a link, no need to give someone the whole thing) - <USER7> the point that one assumes that unless otherwise inaccessible (say, JFK Reloaded isn't available from the publisher any more), better to go download the latest directly from the source rather than a months-old version passed around.

Can't say a definitive "no" to the lead questions, as the world is a big place and there are "underground" groups maintaining limited distribution. On the whole, I'd be surprised to find any.

</comment><comment><USER22> There's no "shareware" per se, but there's plenty of "indie trialware" if you will and it's doing really well.

I have long-time friends who live very comfortably from a small herd of shareware products. I also know others who decided to grow at some point and now operate moderately-sized software shops that too are doing well. All of these are on Windows, and nearly all of them are desktop software. One thing to keep in mind that smaller companies tend to put up a larger corporate facades, so the chances are that you've seen plenty of single-man shareware shops without realizing it.

</comment><comment><USER23> Freemium is the new shareware

</comment><comment><USER24> As a word it looks pretty dead: [https://www.google.com/trends/explore#q=shareware](https://www.google.com/trends/explore#q=shareware)

<comment><USER25> The n-gram viewer goes back further, but only comes up to 2008. It looks like the usage started in the mid 80s, peaked around 95, and was almost dead in 2008.

[https://books.google.com/ngrams/graph?content=shareware&year...](https://books.google.com/ngrams/graph?content=shareware&year_start=1960&year_end=2008&corpus=15&smoothing=0)

</comment></comment><comment><USER21> "Shareware" is an old term. Archaic labels don't sell well.

Now it's called "in-app purchases": get the core app for free, get bonus/improvement material for a fee.

</comment><comment><USER26> Shareware becomes free apps with in-app purchases.

</comment><comment><USER27> Shareware has been renamed to "Apps".

</comment><comment><USER28> There's at least one piece of modern software I use on a daily basis that should count as shareware: Sublime Text.

<comment><USER29> Sure, but does it describe itself as shareware? The original benefit of shareware was that you could redistribute the installer to your friends. This is no longer a compelling benefit, and 'shareware' has serious negative implications nowadays. The term is dead.

</comment></comment><comment><USER30> Yes, Shareware is dead. The entire idea with shareware was that you could share the software with others. The distribution channel was sharing. But the shared software was limited, and those who like what they received could call and upgrade.

</comment><comment><USER31> I'd say shareware still exists, except now such apps ask you to tweet about the app or post on Facebook or pin it on Pinterest.

There are plenty of apps which allow additional functionality or unlock more levels if you tweet or post about them.

</comment><comment><USER32> When you dissect the word "shareware", "share" has an entirely different meaning now.

What did "share" actually mean then?

<comment><USER33> It probably related to the practice of sharing useful tools on CDs. Before the internet the highlight of my month was the CD ROM that came with computer magazines and was loaded with sharewares and freewares.

<comment><USER34> Floppies not CDs

</comment></comment></comment><comment><USER35> The word "shareware" really comes from a pre-internet era, where distribution of software was a challenge.

So the idea is to let your users do the distribution for you, please, you are free to share this software with your friends by letting them have a copy. Or by putting it on a dialup BBS download area. Or by including it on a CD you try to sell people of thousands of mostly crappy shareware/freeware ('freeware' another word that's sort of been eclipsed by the 'open source' revolution), which people are still happy to pay $5 or $10 for, because it was hard to get software otherwise, people didn't have access to an internet with all the software!

Shareware often had all software features unlocked immediately, but encouraged people to pay if they liked it and continued using it. Or maybe not 'encouraged', often "required" by terms of the license, but with no real enforcement mechanism, really just the honor system

Or occasionally locked some features until you had bought a license -- but that was rare in the pre-internet era, because there wasn't a good cheap way to exchange money for license keys, that didn't require building up an expensive infrastructure.

All of these business models are still in use. For instance, you can download SublimeText for free, and use it as long as you want -- buying a SublimeText license does nothing but disable the popup message on startup that says "Please buy a license if you find this useful." I forget the language it uses, how strongly it tries to tell you that you _must_ buy a license to continue using it, but either way it'll let you keep using it forever with the startup popup message, without paying. It's essentially "shareware" as far as that goes -- but there's no need for users to obtain a copy by their friends who already have a copy 'sharing' one; everyone can just download a copy from the ST website themselves.

Some things that basically use this 'business model' are actually open source -- you legally _can_ use the software for whatever you want without paying for it, but if you'd like to support the developers, send money. That's sort of "shareware" too.

But now that it's pretty easy/cheap to set up your own website for people to download software, and sell license keys over the website, and have the software be feature or time-crippled without the license key -- people who really want to require the users to pay in order to keep using the software are more likely to do that. And we don't call it "shareware", it doesn't need a special name, because it's such a common way to do it now, maybe even the predominant way to do it.

The term 'shareware' is from a pre-internet era, and from an era before open source caught on too (and open source catching on came along with the internet era too). And there's no reason to buy a CD of a compilation of mostly crappy freeware/shareware anymore, everyone can just browse the internet and download whatever they like.

</comment><comment><USER36> Among the problems is that "the channel" has squeezed out shareware.

The channel is the path from developer to end-user. At one time, one had to purchase hookers and blow for the distributors. In some respects the app stores are helpful but I regard them as eliminating our ability to determine our own destinies.

</comment><comment><USER37> Yes, open source killed it.</comment>


Maluuba Launches Natural Language Processing API - <AUTHOR> http://techcrunch.com/2012/11/14/maluuba-launches-natural-language-processing-api-brings-siri-like-powers-to-any-app/ <comment><USER2> I am an eternal optimist, and this looks hugely powerful. Have they released any data about possible catches? Any Maluuba-ers out there can give us some guidance for implementation limitations?</comment>


Who Loses Big in the Great Streaming Wars? The User - <AUTHOR> https://www.rollingstone.com/tv/tv-features/streaming-wars-user-experience-sepinwall-1031729/ <comment><USER2> This are real problem that I have with Netflix! Search engine and suggestions that sucks so much.

Stupid, frustrating endless infinite scroll.

If I was in charge of their app, I would have done a few very simple changes that would have improved a lot the user experience!</comment>


Show HN: tunes.io - a new playlist of great songs every day. my weekend project - <AUTHOR> http://tunes.io

<comment><USER2> Really cool. Aside from any design/features/etc, I've found a few awesome bands. I did have to write them down for later, but no big deal. Thanks!

</comment><comment><USER3> Why not generate a Spotify playlist too?

That way, I don't have to open a different website for each song...

You could use the Spotify API...

<comment><AUTHOR> trying to keep it simple, but i'll look into it. no spotify here in canada yet, so it's not something i had considered.

<comment><USER3> I had originally signed up in Canada about three years back with a European proxy. :D

Now that I'm in the States, I can use it easily.

If you do introduce Spotify support and need help testing it, I'd be more than willing to help.

Edit:

But either way, I like it :)</comment></comment></comment>